Identifying trojanized applications for mobile environments

At least one non-transitory computer readable medium storing program code that, when loaded into computer memory and run by a processor, executes the following steps:

• obtaining a plurality of apps for a specific mobile environment, from at least one external source;
• comparing data concerning code, the digital signer, and the date of a first specific one of the obtained apps to data concerning code and a digital signer of a second specific one of the obtained apps of the plurality of apps;
• based on the comparing, determining that the first specific one of the obtained apps contains:
• 1) at least a predetermined threshold amount of code contained in a second specific one of the obtained apps, 2) additional code not present in the second specific one of the obtained apps, 3) a different signer than the second specific one of the obtained apps, and 4) the date of the first specific one of the obtained apps is later than the date of the second specific one of the obtained apps;
• and
• in response to the determining, identifying the first specific one of the obtained apps as being a trojanized app.

A computer system for identifying trojanized apps for mobile environments, the computer system comprising:

• computer memory;
• a processor;
• an app obtaining module residing in the computer memory, the app obtaining module to obtain a plurality of apps for a specific mobile environment, from at least one external source;
• a comparing module residing in the computer memory, the comparing module to compare data concerning, the digital signer, and the date of a first specific one of the obtained apps to data concerning code and a digital signer of a second specific one of the obtained apps of the plurality of apps, and, based on the comparison determining that the first specific one of the obtained apps contains:
• 1) at least a predetermined threshold amount of code contained in a second specific one of the obtained apps, 2) additional code not present in the second specific one of the obtained apps, 3) a different signer than the second specific one of the obtained apps, and 4) the date of the first specific one of the obtained apps is later than the date of the second specific one of the obtained apps;
• and
• a trojanized app identifying module residing in the computer memory, the trojanized app identifying module being configured for identifying the first specific one of the obtained apps as being a trojanized app, in response to the determining.